Terms of Service
Last updated: July 2026
Welcome to OpenSourceBhaiya. These Terms of Service govern your access to this website and any open-source software, projects, or resources published through it. By accessing this website or downloading any software made available here, you agree to these terms.
OpenSourceBhaiya exists to share technology openly, encourage learning, and build useful software with transparency, privacy, and long-term maintainability at its core.
1. Purpose
OpenSourceBhaiya is a personal portfolio and an open-source project hub where software, experiments, tools, and technical resources are shared with the community.
The purpose of this website is to showcase projects, distribute open-source applications, document technical work, and provide educational resources. Nothing published here should be interpreted as professional security, legal, financial, or technical advice unless explicitly stated.
Using this website does not create any professional, commercial, or contractual relationship between you and the maintainer.
2. Open Source Software
Every application distributed through OpenSourceBhaiya is open-source and released under its respective license. The applicable license can always be found within the corresponding GitHub repository.
All software is provided "as is", without warranties of any kind, whether express or implied. This includes, but is not limited to, warranties of merchantability, fitness for a particular purpose, reliability, or non-infringement.
Before using any application, you are encouraged to review the publicly available source code, understand its functionality, and evaluate whether it meets your own security and operational requirements.
Unless otherwise stated, you are free to inspect, modify, fork, and contribute to the projects according to their individual licenses.
3. Limitation of Liability
While every project is developed with care and thoroughly tested before release, no software can guarantee complete freedom from bugs or unexpected behavior.
The maintainer shall not be held responsible for any direct, indirect, incidental, consequential, or special damages arising from the installation, modification, execution, or misuse of any software distributed through this website.
By downloading or using any application, you acknowledge that you do so entirely at your own discretion and risk.
4. Privacy
Privacy is treated as a fundamental design principle rather than an afterthought.
This website does not use invasive third-party tracking systems or advertising technologies to monitor visitors. Any information voluntarily shared through email or contact forms will only be used for direct communication and will never be sold, rented, or shared with third parties without consent unless required by law.
Many of the applications published here follow a Local-First philosophy, meaning sensitive information is processed directly on your own device whenever possible. Unless a feature explicitly requires communication with an external service, applications are designed to avoid unnecessary data collection, telemetry, or background tracking.
5. Third-Party Services
Some applications may integrate with trusted third-party platforms such as GitHub, Google, or other officially supported services when their functionality requires it.
Any integration with third-party services is handled through their official APIs, with appropriate user authorization, and in accordance with each platform's privacy policy and terms of service.
This website may contain links to external websites. Those sites have their own terms of service and privacy policies which you should review independently.
6. Security
Security is considered throughout the development process rather than being treated as a final step.
If you discover a security vulnerability in any project published through OpenSourceBhaiya, responsible disclosure is strongly encouraged. Please avoid publicly disclosing vulnerabilities before they can be reviewed and addressed.
Responsible security research helps improve software for everyone.
7. Changes to These Terms
These Terms of Service may be updated periodically to reflect improvements, legal requirements, or changes to the projects available through this website.
The latest revision date will always appear at the top of this page. Continued use of this website after updates constitutes acceptance of the revised Terms.
8. Contact
Questions regarding these Terms, security reports, collaboration opportunities, or general feedback are always welcome.
Whether you've discovered a bug, identified a security issue, have suggestions for improvement, or simply want to discuss technology, feel free to get in touch through the available contact channels.
Open source grows through collaboration, and every thoughtful contribution helps improve the projects shared here.
9. OTP Sync & Data Privacy
9.1 Core Purpose & Zero-Account Architecture
OTP Sync is a privacy-first, local-first utility created to securely transfer One-Time Passwords (OTPs), 2FA verification codes, and security alerts from your Android device to your computer's clipboard. OTP Sync operates on a strict Zero-Knowledge architecture. The application requires zero user accounts, zero logins, and zero passwords. You do not need to sign in with Google or connect an email inbox to use OTP Sync. All text analysis, pattern matching, and code extraction happen entirely on your device's local processor.
9.2 Android Notification Listener Access
To detect verification codes in real time without requiring you to switch apps, OTP Sync uses the Android Notification Listener permission (BIND_NOTIFICATION_LISTENER_SERVICE). This permission is strictly utilized to intercept incoming notification banners (such as alerts from SMS apps, WhatsApp, Telegram, Gmail, and banking applications) at the exact millisecond they arrive on your phone.
On-Device Regex Parsing: The notification text is scanned purely in volatile device memory using our local extraction engine.
Zero Message History Access: OTP Sync never accesses your inbox history, never reads existing past messages, and never saves notification message bodies.
Immediate Discard: If an incoming notification does not contain a genuine verification code, it is discarded immediately from memory.
9.3 Distribution Editions & SMS Processing
To respect Google Play policies while giving users maximum flexibility, OTP Sync is provided in two distinct editions:
Google Play Edition: Complies strictly with Google Play Developer policies. It does not request SMS read permissions (RECEIVE_SMS or READ_SMS). SMS verification codes are detected solely through incoming notification shade banners via the Notification Listener API.
Full Sideload / GitHub Edition: Includes direct SMS broadcast reception (RECEIVE_SMS). This provides zero-latency code extraction directly from incoming cellular messages without waiting for Android to post a notification banner, and serves as an automated fallback when Android 15+ or carrier RCS chats hide sensitive message content on the lock screen. Direct SMS reading is performed entirely locally on your device and is never uploaded anywhere.
9.4 Camera & Overlay Permissions
Camera Access (CAMERA): The camera permission is requested for the sole purpose of scanning the pairing QR code displayed by the official OTP Sync Chrome Extension. The QR code is scanned entirely on-device using local machine vision. The camera is never used to take photos, record video, or capture personal images, and zero visual data is ever stored on disk or transmitted over the internet.
Display Over Other Apps (SYSTEM_ALERT_WINDOW): This permission allows OTP Sync to run an invisible background helper that copies newly extracted codes to your Android clipboard instantly, even while your screen is locked or while you are using another application, without interrupting your workflow.
9.5 Military-Grade End-to-End Encryption (AES-256-GCM)
Before any detected verification code leaves your phone to reach your computer, it is encrypted natively on your hardware using authenticated military-grade End-to-End Encryption (AES-256-GCM) with a fresh, cryptographically secure 12-byte initialization vector (IV) for every transmission.
Offline Key Exchange: The encryption key is generated locally inside your computer’s Chrome Extension and transferred directly to your phone through the offline QR code scan.
Zero-Knowledge Guarantee: The encryption key is stored securely in your phone’s hardware-backed Android KeyStore (EncryptedSharedPreferences) and is never uploaded to the internet. Because Open Source Bhaiya does not possess your private encryption key, we have zero technical ability to read, decrypt, or intercept your verification codes.
9.6 Ephemeral Relay & Automated Self-Destruction
To beam encrypted payloads between your Android device and your paired computer, OTP Sync uses an ephemeral Firebase Realtime Database relay:
Ciphertext Only: Only unintelligible encrypted ciphertext bytes and the initialization vector are relayed across the network.
Automated 30-Second Self-Destruction: All transmitted payloads are programmed to automatically delete themselves from the relay database within 30 seconds of broadcast.
Immediate Delivery Deletion: When your paired Chrome Extension receives the payload, the pending intent is immediately cleared from the relay. No historical logs, messages, or decrypted codes remain on any server.
9.7 Local Device Vault & Clipboard Auto-Clear
Local Inbox Storage: Extracted OTPs are displayed in a local Inbox history saved strictly inside your device’s private SQLite database (Room). Cloud backups are explicitly disabled (allowBackup="false").
Biometric App Lock: You can lock your local OTP history behind your phone’s native Biometric Authentication (Fingerprint or Face Unlock).
PC Clipboard Auto-Clear: For your security, any code copied to your computer's clipboard by the companion extension is automatically cleared from memory after 60 seconds.
9.8 User Control & Complete Data Deletion
You maintain complete control over your data. You can toggle background synchronization off at any time, remove linked computers with a single tap, or clear your entire local inbox history from the Settings menu. Terminating a paired computer immediately wipes its cryptographic key from your phone and purges its registration from the relay. Uninstalling the application permanently deletes all local databases, cached codes, and cryptographic keys.
9.9 Open Source License, Copyright & Disclaimers
OTP Sync is developed and maintained by Open Source Bhaiya as a free, open-source community utility under the GNU General Public License v3.0 (GPL-3.0). All source code is publicly accessible and auditable on GitHub.
No Warranty (“AS IS”): The software is provided “AS IS”, without warranty of any kind, express or implied. Open Source Bhaiya shall not be held liable for any missed codes, authentication failures, carrier SMS delays, or damages resulting from the use of this software.
Trademark Notice: All trademarks, product names, logos, and brands (including Android, Google, Gmail, WhatsApp, Telegram, Chrome, and others) are the property of their respective owners. Their mention in this application and on our website is solely for functional identification, technical compatibility, and descriptive purposes, and does not imply any affiliation, sponsorship, or endorsement.
10. Refer & Earn Platform — Terms of Use
Platform Overview & Multi-Tenant Architecture
OpenSourceBhaiya provides a modular, white-label referral loyalty platform developed for retail showrooms, merchant stores, and multi-location businesses across India. When deployed for client businesses (such as our live case-study partner Bikers Accessories), the platform operates as a standalone branded Android application facilitating verified customer referral attribution, twin-sided reward incentives, and direct UPI settlement tracking. OpenSourceBhaiya operates strictly as the technology and software provider; all customer rewards, store promotions, and payout settlements are managed and fulfilled directly by the respective merchant partner.
Eligibility & Account Registration
The Refer & Earn application is available to individuals aged 18 years and above residing in India. Each user may register and operate only one active account linked to a single verified mobile number and authenticated email address. Creating duplicate profiles with alternate numbers, setting up dummy accounts, or manipulating the registration process is strictly prohibited. Any fraudulent activity results in immediate account deactivation and permanent forfeiture of all pending reward balances.
Referral Attribution & Ghost Account Linking
Referrals are tracked through unique referral codes and dynamic QR links generated inside the app. A referral is valid only when the referred friend is a first-time customer who completes a verified purchase at the merchant's physical storefront or authorized billing channel. Referral links must be recorded at or before billing; retroactive credits cannot be applied to past transactions. If an unregistered customer is referred, their reward is held in reserve linked to their mobile number and automatically credited once they complete registration. Self-referrals and circular referral loops are automatically detected and nullified.
Reward Fulfillment, UPI Settlements & 72-Hour Confirmation
When an eligible purchase is logged, the platform generates twin rewards: one for the referring customer and a welcome reward for the new buyer. Merchants independently configure their reward offerings (such as direct UPI cashback, store discounts, or gift items). Payouts are disbursed directly by the merchant to the customer's registered UPI ID or delivered in-store. Once the merchant records the settlement along with the official bank reference number (UTR), the customer receives an instant notification to review and confirm receipt. Transactions auto-confirm after 72 hours unless a formal dispute is submitted by the user. If an invoice is cancelled or merchandise returned, the merchant reserves the right to deduct or balance corresponding rewards from future sales.
Data Privacy, Security & Account Deletion
The platform collects only the essential details necessary for referral attribution and reward settlement: full name, verified mobile number, email, and designated UPI ID for payments. In-store invoice numbers and purchase summaries are logged strictly for transaction verification and audit reconciliation. We never monetize, share, or sell customer personal data or store sales metrics to third-party advertisers. Users may request permanent account deletion at any time via in-app profile settings, upon which their personal profile is purged within 30 days, subject only to statutory tax record retention requirements.
Push Notifications & App Version Updates
Registered users receive real-time alerts regarding new referral linkings, earned rewards, and payout settlement references through transactional push notifications, SMS, or WhatsApp. To maintain platform security, ledger consistency, and anti-fraud protections, users must keep their application updated to the latest supported release. Merchants reserve the right to deploy mandatory in-app updates to protect system integrity, and may revise promotional reward structures with reasonable notice posted inside the app.